CWE-77 · Command Injection (page 37)
Page 37 of 39 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-5413 | Critical | 9.8 | 2019-03-21 | An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1. |
CVE-2019-1614 | High | 8.8 | 2019-03-11 | A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an authenticated, remote attacker to execute arbitrary commands with root privileges… |
CVE-2019-1613 | Medium | 6.7 | 2019-03-11 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating syste… |
CVE-2019-1612 | Medium | 4.2 | 2019-03-11 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating syste… |
CVE-2019-1611 | Medium | 6.7 | 2019-03-11 | A vulnerability in the CLI of Cisco NX-OS Software and Cisco FXOS Software could allow an authenticated, local attacker to execute arbitrary commands on the un… |
CVE-2019-1610 | Medium | 6.7 | 2019-03-11 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating syste… |
CVE-2019-1609 | Medium | 6.7 | 2019-03-08 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating syste… |
CVE-2019-1608 | Medium | 6.7 | 2019-03-08 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating syste… |
CVE-2019-1607 | Medium | 6.7 | 2019-03-08 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating syste… |
CVE-2019-1606 | High | 7.8 | 2019-03-08 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating syste… |
CVE-2018-20236 | High | 8.8 | 2019-03-08 | There was an command injection vulnerability in Sourcetree for Windows from version 0.5a before version 3.0.10 via URI handling. A remote attacker could send a… |
CVE-2019-3920 | High | 8.8 | 2019-03-05 | The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to authenticated command injection via crafted HTTP request sent by a… |
CVE-2019-3919 | High | 8.8 | 2019-03-05 | The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to command injection via crafted HTTP request sent by a remote, authen… |
CVE-2013-2516 | High | 8.8 | 2019-02-15 | Vulnerability in FileUtils v0.7, Ruby Gem Fileutils <= v0.7 Command Injection vulnerability in user supplied url variable that is passed to the shell. |
CVE-2016-1000282 | Critical | 9.8 | 2019-02-05 | Haraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files. Versions 2.8.8 and earlier can be vulnerable to command injectio… |
CVE-2019-1000018 | High | 7.8 | 2019-02-04 | rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in allowscp permission… |
CVE-2019-3913 | Medium | 4.9 | 2019-01-30 | Command manipulation in LabKey Server Community Edition before 18.3.0-61806.763 allows an authenticated remote attacker to unmount any drive on the system lead… |
CVE-2018-19015 | High | 7.3 | 2019-01-28 | An attacker could inject commands to launch programs and create, write, and read files on CX-Supervisor (Versions 3.42 and prior) through a specially crafted p… |
CVE-2019-6986 | High | 7.5 | 2019-01-28 | SPARQL Injection in VIVO Vitro v1.10.0 allows a remote attacker to execute arbitrary SPARQL via the uri parameter, leading to a regular expression denial of se… |
CVE-2019-1646 | High | 7.8 | 2019-01-24 | A vulnerability in the local CLI of the Cisco SD-WAN Solution could allow an authenticated, local attacker to escalate privileges and modify device configurati… |
CVE-2018-19013 | Medium | 5.0 | 2019-01-22 | An attacker could inject commands to delete files and/or delete the contents of a file on CX-Supervisor (Versions 3.42 and prior) through a specially crafted p… |
CVE-2018-5412 | High | 7.8 | 2019-01-10 | Imperva SecureSphere running v12.0.0.50 is vulnerable to local arbitrary code execution, escaping sealed-mode. |
CVE-2018-5403 | High | 8.1 | 2019-01-10 | Imperva SecureSphere gateway (GW) running v13, for both pre-First Time Login or post-First Time Login (FTL), if the attacker knows the basic authentication pas… |
CVE-2017-15403 | High | 7.3 | 2019-01-09 | Insufficient data validation in crosh could lead to a command injection under chronos privileges in Networking in Google Chrome on Chrome OS prior to 61.0.3163… |
CVE-2019-0541 | High | 8.8 | 2019-01-08 | A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code Execution Vulnerabili… |
CVE-2018-17172 | Critical | 9.8 | 2019-01-03 | The web application on Xerox AltaLink B80xx before 100.008.028.05200, C8030/C8035 before 100.001.028.05200, C8045/C8055 before 100.002.028.05200, and C8070 bef… |
CVE-2018-19911 | High | 7.5 | 2018-12-06 | FreeSWITCH through 1.8.2, when mod_xml_rpc is enabled, allows remote attackers to execute arbitrary commands via the api/system or txtapi/system (or api/bg_sys… |
CVE-2018-14746 | Critical | 9.8 | 2018-11-28 | Command Injection vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829 and earlier versions… |
CVE-2018-14893 | High | 8.8 | 2018-11-27 | A system command injection vulnerability in zyshclient in ZyXEL NSA325 V2 version 4.81 allows attackers to execute system commands via the web application API. |
CVE-2018-16462 | Critical | 10.0 | 2018-10-30 | A command injection vulnerability in the apex-publish-static-files npm module version <2.0.1 which allows arbitrary shell command execution through a malicious… |
CVE-2018-16461 | Critical | 9.8 | 2018-10-30 | A command injection vulnerability in libnmapp package for versions <0.4.16 allows arbitrary commands to be executed via arguments to the range options. |
CVE-2016-10729 | High | 7.8 | 2018-10-24 | An issue was discovered in Amanda 3.3.1. A user with backup privileges can trivially compromise a client installation. The "runtar" setuid root binary does not… |
CVE-2018-17445 | Critical | 9.8 | 2018-10-23 | A Command Injection issue was discovered in Citrix SD-WAN 10.1.0 and NetScaler SD-WAN 9.3.x before 9.3.6 and 10.0.x before 10.0.4. |
CVE-2018-14649 | Critical | 9.8 | 2018-10-09 | It was found that ceph-isci-cli package as shipped by Red Hat Ceph Storage 2 and 3 is using python-werkzeug in debug shell mode. This is done by setting debug=… |
CVE-2018-0481 | Medium | 6.7 | 2018-10-05 | A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to execute commands on the underlying Linux shell of an… |
CVE-2018-0477 | Medium | 6.7 | 2018-10-05 | A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to execute commands on the underlying Linux shell of an… |
CVE-2018-0454 | High | 8.8 | 2018-10-05 | A vulnerability in the web-based management interface of Cisco Cloud Services Platform 2100 could allow an authenticated, remote attacker to perform command in… |
CVE-2018-0433 | High | 7.8 | 2018-10-05 | A vulnerability in the command-line interface (CLI) in the Cisco SD-WAN Solution could allow an authenticated, local attacker to inject arbitrary commands that… |
CVE-2018-0431 | High | 8.8 | 2018-10-05 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to… |
CVE-2018-0430 | High | 8.8 | 2018-10-05 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to… |
CVE-2018-0424 | High | 8.8 | 2018-10-05 | A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco… |
CVE-2014-10075 | Critical | 9.8 | 2018-10-05 | The karo gem 2.3.8 for Ruby allows Remote command injection via the host field. |
CVE-2018-1000802 | Critical | 9.8 | 2018-09-18 | Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')… |
CVE-2018-0718 | Critical | 9.8 | 2018-09-14 | Command injection vulnerability in Music Station 5.1.2 and earlier versions in QNAP QTS 4.3.3 and 4.3.4 could allow remote attackers to run arbitrary commands… |
CVE-2018-16460 | Critical | 9.8 | 2018-09-07 | A command Injection in ps package versions <1.0.0 for Node.js allowed arbitrary commands to be executed when attacker controls the PID. |
CVE-2016-9044 | High | 8.8 | 2018-09-07 | An exploitable command execution vulnerability exists in Information Builders WebFOCUS Business Intelligence Portal 8.1 . A specially crafted web parameter can… |
CVE-2018-3786 | Critical | 9.8 | 2018-08-24 | A command injection vulnerability in egg-scripts <v2.8.1 allows arbitrary shell command execution through a maliciously crafted command line argument. |
CVE-2018-15356 | High | 8.8 | 2018-08-17 | An authenticated attacker can execute arbitrary code using command ejection in Eltex ESP-200 firmware version 1.2.0. |
CVE-2018-0427 | High | 8.8 | 2018-08-15 | A vulnerability in the CronJob scheduler API of Cisco Digital Network Architecture (DNA) Center could allow an authenticated, remote attacker to perform a comm… |
CVE-2018-0714 | Critical | 9.8 | 2018-08-13 | Command injection vulnerability in Helpdesk versions 1.1.21 and earlier in QNAP QTS 4.2.6 build 20180531, QTS 4.3.3 build 20180528, QTS 4.3.4 build 20180528 an… |
CVE-2018-3779 | Critical | 9.8 | 2018-08-10 | active-support ruby gem 5.2.0 could allow a remote attacker to execute arbitrary code on the system, caused by containing a malicious backdoor. An attacker cou… |
CVE-2018-9866 | Critical | 9.8 | 2018-08-03 | A vulnerability in lack of validation of user-supplied parameters pass to XML-RPC calls on SonicWall Global Management System (GMS) virtual appliance's, allow… |
CVE-2016-8628 | High | 7.6 | 2018-07-31 | Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variabl… |
CVE-2018-3772 | Critical | 9.8 | 2018-07-30 | Concatenating unsanitized user input in the `whereis` npm module < 0.4.1 allowed an attacker to execute arbitrary commands. The `whereis` module is deprecated… |
CVE-2018-0351 | High | 7.8 | 2018-07-18 | A vulnerability in the command-line tcpdump utility in the Cisco SD-WAN Solution could allow an authenticated, local attacker to inject arbitrary commands that… |
CVE-2018-0350 | High | 8.8 | 2018-07-18 | A vulnerability in the VPN subsystem configuration in the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject arbitrary commands that… |
CVE-2018-0348 | High | 7.2 | 2018-07-18 | A vulnerability in the CLI of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root… |
CVE-2018-0347 | High | 7.8 | 2018-07-18 | A vulnerability in the Zero Touch Provisioning (ZTP) subsystem of the Cisco SD-WAN Solution could allow an authenticated, local attacker to inject arbitrary co… |
CVE-2018-0344 | High | 7.2 | 2018-07-18 | A vulnerability in the vManage dashboard for the configuration and management service of the Cisco SD-WAN Solution could allow an authenticated, remote attacke… |
CVE-2018-0341 | High | 8.8 | 2018-07-16 | A vulnerability in the web-based UI of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware before 11.2(1) could allow an authenticated, remo… |
CVE-2016-6558 | Critical | 9.8 | 2018-07-13 | A command injection vulnerability exists in apply.cgi on the ASUS RP-AC52 access point, firmware version 1.0.1.1s and possibly earlier, web interface specifica… |
CVE-2018-8306 | Medium | 5.5 | 2018-07-11 | A command injection vulnerability exists in the Microsoft Wireless Display Adapter (MWDA) when the Microsoft Wireless Display Adapter does not properly manage… |
CVE-2018-7785 | Critical | 9.8 | 2018-07-03 | In Schneider Electric U.motion Builder software versions prior to v1.3.4, a remote command injection allows authentication bypass. |
CVE-2018-1244 | High | 8.8 | 2018-07-02 | Dell EMC iDRAC7/iDRAC8, versions prior to 2.60.60.60, and iDRAC9 versions prior to 3.21.21.21 contain a command injection vulnerability in the SNMP agent. A re… |
CVE-2018-1212 | High | 8.8 | 2018-07-02 | The web-based diagnostics console in Dell EMC iDRAC6 (Monolithic versions prior to 2.91 and Modular all versions) contains a command injection vulnerability. A… |
CVE-2018-12465 | Critical | 9.1 | 2018-06-29 | An OS command injection vulnerability in the web administration component of Micro Focus Secure Messaging Gateway (SMG) allows a remote attacker authenticated… |
CVE-2018-0712 | Critical | 9.8 | 2018-06-21 | Command injection vulnerability in LDAP Server in QNAP QTS 4.2.6 build 20171208, QTS 4.3.3 build 20180402, QTS 4.3.4 build 20180413 and their earlier versions… |
CVE-2018-5428 | High | 8.8 | 2018-06-20 | The version control adapters component of TIBCO Data Virtualization (formerly known as Cisco Information Server) contains vulnerabilities that may allow for ar… |
CVE-2011-4182 | High | 7.3 | 2018-06-12 | Missing escaping of ESSID values in sysconfig of SUSE Linux Enterprise allows attackers controlling an access point to cause execute arbitrary code. Affected r… |
CVE-2014-5220 | High | 7.8 | 2018-06-08 | The mdcheck script of the mdadm package for openSUSE 13.2 prior to version 3.3.1-5.14.1 does not properly sanitize device names, which allows local attackers t… |
CVE-2017-12078 | High | 7.2 | 2018-06-08 | Command injection vulnerability in EZ-Internet in Synology Router Manager (SRM) before 1.1.6-6931 allows remote authenticated users to execute arbitrary comman… |
CVE-2017-12075 | High | 7.2 | 2018-06-08 | Command injection vulnerability in EZ-Internet in Synology DiskStation Manager (DSM) before 6.2-23739 allows remote authenticated users to execute arbitrary co… |
CVE-2017-16100 | Critical | 9.8 | 2018-06-07 | dns-sync is a sync/blocking dns resolver. If untrusted user input is allowed into the resolve() method then command injection is possible. |
CVE-2018-3746 | Critical | 9.8 | 2018-06-01 | The pdfinfojs NPM module versions <= 0.3.6 has a command injection vulnerability that allows an attacker to execute arbitrary commands on the victim's machine. |
CVE-2016-7076 | Medium | 6.4 | 2018-05-29 | sudo before version 1.8.18p1 is vulnerable to a bypass in the sudo noexec restriction if application run via sudo executed wordexp() C library function with a… |
CVE-2018-1111 | High | 7.5 | 2018-05-17 | DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in the NetworkManager integration script i… |
CVE-2018-0324 | Medium | 6.7 | 2018-05-17 | A vulnerability in the CLI of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, high-privileged, local attacker to perform a c… |
CVE-2014-5014 | Critical | 9.8 | 2018-04-25 | The WordPress Flash Uploader plugin before 3.1.3 for WordPress allows remote attackers to execute arbitrary commands via vectors related to invalid characters… |
CVE-2017-2833 | High | 7.5 | 2018-04-24 | An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52… |
CVE-2017-2832 | High | 7.2 | 2018-04-24 | An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52… |
CVE-2014-8888 | Critical | 9.8 | 2018-04-12 | The remote administration interface in D-Link DIR-815 devices with firmware before 2.03.B02 allows remote attackers to execute arbitrary commands via vectors r… |
CVE-2014-6120 | Critical | 9.8 | 2018-04-12 | IBM Rational AppScan Source 8.0 through 8.0.0.2 and 8.5 through 8.5.0.1 and Security AppScan Source 8.6 through 8.6.0.2, 8.7 through 8.7.0.1, 8.8, 9.0 through… |
CVE-2014-6633 | High | 8.8 | 2018-04-12 | The safe_eval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 allows remote a… |
CVE-2014-3114 | Critical | 9.8 | 2018-04-10 | The EZPZ One Click Backup (ezpz-one-click-backup) plugin 12.03.10 and earlier for WordPress allows remote attackers to execute arbitrary commands via the cmd p… |
CVE-2017-7161 | High | 8.8 | 2018-04-03 | An issue was discovered in certain Apple products. Safari before 11.0.2 is affected. The issue involves the "WebKit Web Inspector" component. It allows remote… |
CVE-2017-0916 | Critical | 9.8 | 2018-03-21 | Gitlab Community Edition version 10.3 is vulnerable to a lack of input validation in the system_hook_push queue through web hook component resulting in remote… |
CVE-2017-0915 | Critical | 9.8 | 2018-03-21 | Gitlab Community Edition version 10.2.4 is vulnerable to a lack of input validation in the GitlabProjectsImportService resulting in remote code execution. |
CVE-2018-0224 | Medium | 6.7 | 2018-03-08 | A vulnerability in the CLI of the Cisco StarOS operating system for Cisco ASR 5000 Series Aggregation Services Routers could allow an authenticated, local atta… |
CVE-2018-0217 | Medium | 6.7 | 2018-03-08 | A vulnerability in the CLI of the Cisco StarOS operating system for Cisco ASR 5000 Series Aggregation Services Routers could allow an authenticated, local atta… |
CVE-2018-5439 | Critical | 9.8 | 2018-02-19 | A Command Injection issue was discovered in Nortek Linear eMerge E3 series Versions V0.32-07e and prior. A remote attacker may be able to execute arbitrary cod… |
CVE-2016-8523 | High | 8.8 | 2018-02-15 | A Remote Arbitrary Code Execution vulnerability in HPE Smart Storage Administrator version before v2.60.18.0 was found. |
CVE-2017-1720 | Medium | 5.3 | 2018-02-13 | IBM Notes 8.5 and 9.0 could allow a local attacker to execute arbitrary commands by carefully crafting a command line sent via the shared memory IPC. IBM X-For… |
CVE-2016-5397 | High | 8.8 | 2018-02-12 | The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apach… |
CVE-2014-1834 | High | 7.8 | 2018-02-02 | The perform_request function in /lib/echor/backplane.rb in echor 0.1.6 Ruby Gem allows local users to inject arbitrary code by adding a semi-colon in their use… |
CVE-2017-14593 | High | 8.8 | 2018-01-26 | Sourcetree for Windows had several argument and command injection bugs in Mercurial and Git repository handling. An attacker with permission to commit to a rep… |
CVE-2017-14592 | High | 8.8 | 2018-01-26 | Sourcetree for macOS had several argument and command injection bugs in Mercurial and Git repository handling. An attacker with permission to commit to a repos… |
CVE-2016-0324 | High | 8.8 | 2018-01-12 | IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 allows remote authenticated users to execute arbitra… |
CVE-2018-0007 | Critical | 9.8 | 2018-01-10 | An unauthenticated network-based attacker able to send a maliciously crafted LLDP packet to the local segment, through a local segment broadcast, may be able t… |
CVE-2017-15940 | Critical | 9.8 | 2017-12-11 | The web interface packet capture management component in Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8… |
CVE-2017-15889 | High | 8.8 | 2017-12-04 | Command injection vulnerability in smart.cgi in Synology DiskStation Manager (DSM) before 5.2-5967-5 allows remote authenticated users to execute arbitrary com… |